CVE-2019-16779

NameCVE-2019-16779
DescriptionIn RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2070-1
NVD severitymedium
Debian Bugs946904

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ruby-excon (PTS)jessie0.33.0-2vulnerable
jessie (security)0.33.0-2+deb8u1fixed
stretch0.54.0-1vulnerable
buster0.60.0-1vulnerable
bullseye, sid0.60.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ruby-exconsource(unstable)0.60.0-2946904
ruby-exconsourcejessie0.33.0-2+deb8u1DLA-2070-1

Notes

[buster] - ruby-excon <no-dsa> (Minor issue)
[stretch] - ruby-excon <no-dsa> (Minor issue)
https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9
https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29

Search for package or bug name: Reporting problems